Re: [patch] exec-shield-nx-2.6.9-A1

[Albert Cahalan]

You have some bits in this patch that don't belong.
They aren't even conditional on a config option or
sysctl value.

First, you change the permission on the /proc/*/maps file.
Normally a remote attacker is unable to read this anyway,
and a local setuid attack has time to try until success.
Changing the permission might be a good idea, mostly
because it exposes filenames, but it should be a separate
patch.

Second, you restrict wchan. Oddly, you don't allow for
the target task's euid to play a role, and you chose the
CAP_SYS_NICE bit instead of some other bit. Huh? One might
guess from CAP_SYS_NICE that the feature has now become
hopelessly slow. Same as with the maps file, this should
be a separate patch.




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/